ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity linked to the Aisuru threat campaign by identifying network and endpoint interactions matching three specific Indicators of Compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical because early detection of Aisuru’s unique IOCs enables rapid containment before the adversary can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: Aisuru Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`139[.]59[.]144[.]8:9034`	botnet_cc	2026-08-07	100%
ip:port	`139[.]59[.]144[.]8:8443`	botnet_cc	2026-08-07	100%
ip:port	`159[.]203[.]172[.]232:8080`	botnet_cc	2026-08-07	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["139.59.144.8", "159.203.172.232"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["139.59.144.8", "159.203.172.232"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

False Positive Scenarios for “ThreatFox: Aisuru IOCs” Rule

Scenario: Enterprise Endpoint Protection Updates
- Context: The organization utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint. During scheduled nightly update cycles, the endpoint protection agent downloads definition signatures from a vendor repository that shares an IP address or hash with one of the Aisuru IOCs. This often triggers when the update server is hosted in a cloud region (e.g., AWS us-east-1) overlapping with the IOC’s network range.
- Suggested Filter: Exclude alerts where the Process_Name matches FalconSensor.exe, MsMpEng.exe, or DefenderService.exe and the Parent_Process_Name is a known system service (e.g., svchost.exe). Additionally, add a filter to exclude traffic originating from internal update server subnets (e.g., 10.20.50.0/24) if the IOC is an IP address.
Scenario: Automated Backup and Archiving Jobs
- Context: The IT operations team runs nightly backup jobs using Veeam Backup & Replication or Commvault. These tools often establish connections to external cloud storage providers (like AWS S3 or Azure Blob) for off-site archiving. If the Aisuru IOC includes a specific domain or IP associated with these cloud providers, the backup agent’s outbound connection will generate a false positive match.
- Suggested Filter: Create an exclusion rule based on Scheduled_Task_Name containing keywords like “Veeam”, “Commvault”, or “BackupJob”. Furthermore, filter out events where the User_Account is a dedicated service account (e.g., svc_backup_admin) and the destination port matches standard HTTPS (443) or SFTP (22).